Category Archives: Hardware

Meraki MS210/MS225 hardware overview

The Meraki MS210 and MS225 series switches offer 24 or 48 ports of Gigabit Ethernet, four SFP/SFP+ uplink ports, a dedicated remote management port, and stacking capabilities via QSFP.

Meraki MS210-24 and MS210-48

The MS210/MS225 series are based on the Broadcom BCM56160 “Hurricane3” ASIC, and the Broadcom BCM82756 10G PHY. PoE models contain the Broadcom BCM59121 PSE controller. All switch models have 16MB of SPI flash (MX25L12805D), 256MB of NAND (MT29F2G08ABAEAWP), and 1024MB of DDR4 DRAM.

MS225-48LP internal PCB

MS225-48LP switch internals with PoE midplane removed

The Meraki codename for the MS210 and MS225 series is “brumby” and all brumby switches run the same firmware release (switch-arm). The MS250 is essentially the MS225 with hot-swap power supplies (similar to the MS220/MS320).

Keen readers may be wondering why the MS210 series has only SFP ports while the MS225 has SFP+ ports, given they are identical hardware and run the same switch-arm firmware. The answer is market segmentation; Meraki decided to artificially limit the speed of the MS210 SFP ports to 1G, even though the MS210 hardware is capable of 10G via SFP+. Early in the boot process switch_brain checks the switch model, and if it identifies as the MS210 series the SFP port speed is limited to 1000M.

The stock Meraki boot process uses u-boot on SPI to load a “bootkernel” (also from SPI), which then initializes NAND and using kexec boots the main firmware. The firmware layout follows the standard Meraki practice of having A/B firmware images: bootkernel1, bootkernel2, part.safe, part.old.


If you wish to flash your MS210/MS225, you will need to remove or socket the SOIC8 SPI flash (U18). This is because the ASIC is powered by the same +3.3V voltage rail as the SPI flash, and will attempt to boot when you attach your flashing device, which interferes with your ability to read/write the contents of flash. I prefer the Wieson G6179-10 SOIC8 socket (available from Adafruit). People outside the US will probably find it easier to desolder the flash and use a SOIC8 socket with prototype wires, as the G6179-10 is difficult to obtain for a reasonable price.

MS225 with SPI flash socket installed

Unlike the MS120, the MS210/MS225 do not implement secure boot, so all that is needed to develop on the platform is to recompile and flash u-boot from the Meraki GPL release and then interrupt the boot process and provide your own firmware build (e.g. via TFTP).

The UART header is J31 on both the 24 and 48 port models and follows the standard Meraki UART pinout (1: VCC, 2: Tx, 3: Rx, 4: GND) at 115200 baud.


The Broadcom SDK for the BCM56160 series implements the packet engine in userspace, using the linux_kernel_bde and linux_user_bde kernel modules to interface with the ASIC. In the Meraki firmware, the packet engine is a component of the userspace click daemon, which loads the bcm_click shared object during click router initialisation.

There are no public datasheets available for any of the Broadcom chips used in the MS210/225. While you can find information on OpenBCM, as far as I can tell the API provided by OpenBCM (via the kernel modules) which is used to implement the packet engine has no public documentation. If anyone has more information, please get in touch 😀

Riverbed SteelHead CX 255

The Riverbed SteelHead are a series of bandwidth optimization appliances that can typically be found for a reasonable price on eBay. Today we are looking at the Riverbed CX 255 (36€ from eBay.de), a small unit with 3 Ethernet interfaces.
Riverbed SteelHead CX 255

Powering the CX 255 is an Intel Celeron 725C (1C2T) soldered to the NAMB-3250MB motherboard, along with with 2GB of DDR3-1333 unbuffered ECC. You will not win any benchmarks with this CPU.

NAMB-3250MB motherboard (Rev. A102-1; 19A2325001-01) inside the CX 255

The CX 255 consumes 20W idle, and is powered by an external 12V 7A power supply (5.5×2.5mm, center positive).

Running powertop --auto-tune sadly does nothing to the reduce power consumption. It appears to the primary reason for this is the high power consumption of the DH89xxCC chipset used

DH89xxCC chipset features and TDP (PDF)

The console port uses the Cisco rollover cable pinout, and operates at 115200n8. The two 40mm PWM fans run at around 5000RPM, and while not they do not scream as some 1U servers do, they are clearly audible from several meters away.


OpenWrt x86-64 running on the CX 255

00:00.0 Host bridge: Intel Corporation 2nd Generation Core Processor Family DRAM Controller (rev 09)
00:01.0 PCI bridge: Intel Corporation Xeon E3-1200/2nd Generation Core Processor Family PCI Express Root Port (rev 09)
00:1c.0 PCI bridge: Intel Corporation DH89xxCC PCI Express Root Port #1 (rev 08)
00:1d.0 USB controller: Intel Corporation DH89xxCC USB2 Enhanced Host Controller #1 (rev 08)
00:1f.0 ISA bridge: Intel Corporation DH89xxCC LPC Controller (rev 08)
00:1f.2 SATA controller: Intel Corporation DH89xxCC 4 Port SATA AHCI Controller (rev 08)
00:1f.3 SMBus: Intel Corporation DH89xxCC SMBus Controller (rev 08)
00:1f.6 Signal processing controller: Intel Corporation DH89xxCC Thermal Subsystem (rev 08)
00:1f.7 System peripheral: Intel Corporation DH89xxCC Watchdog Timer (rev 08)
01:00.0 Co-processor: Intel Corporation DH89XXCC Series QAT (rev 21)
01:00.1 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.2 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
02:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)

There are also the CX 570 and CX 770, which appear quite similar from the exterior. The CX 570 and CX 770 have three additional Ethernet interfaces and better CPUs. According to this document (PDF) the CX 570 has an Intel Pentium B925C while the CX 770 has an Intel Xeon E3-1125C v2.

From the lspci output on the CX 255 and the board layout, I assume that the CX 570/770 has an additional I210 controller and the remaining 2 Ethernet PHYs from the DH8900CC populated. I anticipate that the idle power consumption is similar to that of the CX 255.


Here is the lspci output from the CX 770:

00:00.0 Host bridge: Intel Corporation 3rd Gen Core processor DRAM Controller (rev 09)
00:01.0 PCI bridge: Intel Corporation Xeon E3-1200 v2/3rd Gen Core processor PCI Express Root Port (rev 09)
00:1c.0 PCI bridge: Intel Corporation DH89xxCC PCI Express Root Port #1 (rev 08)
00:1c.1 PCI bridge: Intel Corporation DH89xxCC PCI Express Root Port #2 (rev 08)
00:1d.0 USB controller: Intel Corporation DH89xxCC USB2 Enhanced Host Controller #1 (rev 08)
00:1f.0 ISA bridge: Intel Corporation DH89xxCC LPC Controller (rev 08)
00:1f.2 SATA controller: Intel Corporation DH89xxCC 4 Port SATA AHCI Controller (rev 08)
00:1f.3 SMBus: Intel Corporation DH89xxCC SMBus Controller (rev 08)
00:1f.6 Signal processing controller: Intel Corporation DH89xxCC Thermal Subsystem (rev 08)
00:1f.7 System peripheral: Intel Corporation DH89xxCC Watchdog Timer (rev 08)
01:00.0 Co-processor: Intel Corporation DH89XXCC Series QAT (rev 21)
01:00.1 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.2 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.3 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
01:00.4 Ethernet controller: Intel Corporation DH8900CC Series Gigabit Network Connection (rev 21)
02:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)
03:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)

The CX 770 also includes minimal lights out management (Aspeed AST1050 BMC), which can be configured to share the PRI ethernet interface. The BMC only provides remote power control and sensor readings, there is no support for KVM or serial console redirection.

HP Z420 ATX modification

Using proprietary OEM motherboards outside their intended use case is not a new subject. OEM motherboards are typically less expensive than their enthusiast counterparts on the second hand market, and they often incorporate features that the enthusiast offers lack, such as an integrated TPM or additional I/O.

The HP Z420 is a workstation based on the LGA 2011 (Sandy/Ivy Bridge-EP) socket, released in 2012. There are various forum threads around the internet discussing how to operate the motherboard with a third-party power supply and chassis, however I have not found a succinct document that outlines all the steps required to use the motherboard without HP original parts.


The motherboard has an 18+8pin power arrangement. The motherboard is almost entirely 12V powered, with +11VSB being the only other voltage present. The pinout of the 18 pin main power connector is as follows:

HP Z210/Z420/Z620 18 pin motherboard power pinout

The following pins are the only pins required to power the motherboard:

Z420 PinDescriptionATX PSU pin
1, 105V output from the motherboardN/A
2-6, 11Ground3, 5, 7, 15, 17-19, 24
7, 12-1512V input10-11
8/PSON16
17+11VSB inputN/A (step-up from +5VSB)
18-12V input (not required)N/A

It is possible to inexpensively build an adapter out of a 24 pin ATX extension table and a DC buck-boost converter to step +5VSB up to +11VSB. You can also find very inexpensive adapters for sale on eBay or AliExpress which are purpose built for the Z420/Z620:

ATX to Z420/Z620 18pin adapter

These adapters are typically around $5 and include the buck-boost circuit needed to provide +11VSB (located in the black shrink wrap mid-cable).

The 8 pin power connector on the motherboard is identical to the ATX EPS power connector. However, the EPS power is on a right angle facing the top of the motherboard, you may have clearance issues installing the motherboard into some ATX chassis.


The CPU socket backplate has extrusions which will interfere with your chassis (assuming your chassis does not have a cut-out behind the CPU for accessing the backplate without removing the motherboard). These can be removed by fatiguing the metal (repeated bending using pliers) or with a dremel.

Some other minor modifications are required to convince the motherboard that it is running inside an HP chassis.

From HP service manual (PDF)

CPU fan (25): Connect pin 1 to pin 5

Front panel audio (2): Connect pin 2 (GND) to pin 4 (presence), since the pins are adjacent you can use a jumper. Connect pin 7 (sense_send) to pin 2 (GND).

Front panel IEEE1394 (1): Connect pin 11 (TPB-) to pin 12 (GND), since the pins are adjacent you can use a jumper.

Front panel LEDS (30): Connect pin 11 to Base and Collector of a 2222A NPN transistor, connect pin 12 to the 2222A Emitter.

From HP forum

Front panel USB3.0 (5): Connect pin 10 (USB3B_ID) to GND (one of pins 4, 7, 13, 16)

From HP forum

Front panel USB2.0 (4): Connect pin 8 (GND) to pin 10 (DRAIN), since the pins are adjacent you can use a jumper.


Top view of the front-panel headers on the Z420 motherboard with modifications
HP Z420 motherboard rear showing bridged connections for CPU fan, FP-USB3.0, FP-audio

A final word on power consumption: the Z420 motherboard consumes around 40W idle (E5-2630v2), but supports ACPI suspend-to-ram (S3) and consumes around 10W when in S3. Wake-on-LAN does not work when using an ATX power supply.